[MDEV-40058] cached_sha2_password crashes on zero-length password - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 11.4, 11.8, 12.3
Fix Version/s: 11.4.13, 11.8.9, 12.3.3
Component/s: Authentication and Privilege System, Plugins
Labels:
- Cloned

Bug Category:
Can result in hang or crash

Description


    pkt_len= (int)plain_text_len;
  }
  /* now pkt contains plaintext password */
 
  authstr= (struct digest*)info->auth_string;
  sha256_crypt_r(pkt, pkt_len-1, authstr->salt, sizeof(authstr->salt),

here pkt_len can be 0, it'll crash sha256_crypt_r.

Attachments

Activity

People

Assignee:: Sergei Golubchik

Reporter:: Sergei Golubchik

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 2026-06-15 20:51

Updated:: 5 days ago 18:49

Resolved:: 2026-06-17 16:10

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

mysql_sha2.c
126	pkt_len= (int)plain_text_len;
127	}
128	/* now pkt contains plaintext password */
129
130	authstr= (struct digest*)info->auth_string;
131	sha256_crypt_r(pkt, pkt_len-1, authstr->salt, sizeof(authstr->salt),